Alpine: multiple bind packages: security update to 9.20.30-r0

high Tenable Self-Hosted Container Security Plugin ID 476652

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional
processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such
structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26,
9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. (CVE-2026-19630)

- Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can
capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By
also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote
code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0
through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. (CVE-2026-94300)

- A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort
with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through
9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1
through 9.20.29-S1. (CVE-2026-96888)

- A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive
query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the
BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default
setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9
versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through
9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. (CVE-2026-97313)

Solution

Update the bind library and its related packages to version 9.20.30-r0 or later.

Plugin Details

Severity: High

ID: 476652

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/22/2026

Updated: 10/22/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.51

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-94300

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313

IAVA: 2026-A-1197

Detections

Analytics